GHSA-cwx6-cx7x-4q34 — LibreNMS vulnerable to SQL injection time-based leads to database extraction

LibreNMS vulnerable to SQL injection time-based leads to database extraction

The advisory, in context

Summary

SQL injection vulnerability in POST /search/search=packages in LibreNMS 24.3.0 allows a user with global read privileges to execute SQL commands via the package parameter.

Details

There is a lack of hygiene of data coming from the user in line 83 of the file librenms/includes/html/pages/search/packages.inc.php vulnerability

PoC

https://doc.clickup.com/9013166444/p/h/8ckm0bc-53/16811991bb5fff6

Impact

With this vulnerability, we can exploit a SQL injection time based vulnerability to extract all data from the database, such as administrator credentials

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

librenms/librenms Packagist

Ecosystem versions

Earlier releases before 24.4.0

Fixed in 24.4.0

121 explicitly affected versions

1.19, 1.20, 1.20.1, 1.21, 1.22, 1.22.01, 1.23, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.30, 1.30.01, 1.31, 1.31.01, 1.31.02, 1.31.03, 1.32, 1.32.01, 1.33, 1.33.01, 1.34, 1.35, 1.36, 1.36.01, 1.37, 1.38, 1.39, 1.40, 1.41, 1.42, 1.42.01, 1.43, 1.44, 1.45, 1.46, 1.47, 1.48, 1.48.1, 1.49, 1.50, 1.50.1, 1.51, 1.52, 1.53, 1.53.1, 1.54, 1.55, 1.56, 1.57, 1.58, 1.58.1, 1.59, 1.60, 1.61, 1.62, 1.62.1, 1.62.2, 1.63, 1.64, 1.64.1, 1.65, 1.65.1, 1.66, 1.67, 1.68, 1.69, 1.70.0, 1.70.1, 21.1.0, 21.10.0, 21.10.1, 21.10.2, 21.11.0, 21.12.0, 21.12.1, 21.2.0, 21.3.0, 21.4.0, 21.5.0, 21.5.1, 21.6.0, 21.7.0, 21.8.0, 21.9.0, 21.9.1, 22.1.0, 22.10.0, 22.11.0, 22.12.0, 22.2.0, 22.2.1, 22.2.2, 22.3.0, 22.4.0, 22.4.1, 22.5.0, 22.6.0, 22.7.0, 22.8.0, 22.9.0, 23.1.0, 23.1.1, 23.10.0, 23.11.0, 23.2.0, 23.4.0, 23.4.1, 23.5.0, 23.6.0, 23.7.0, 23.8.0, 23.8.1, 23.8.2, 23.9.0, 23.9.1, 24.1.0, 24.2.0, 24.3.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "24.4.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.19",
    "1.20",
    "1.20.1",
    "1.21",
    "1.22",
    "1.22.01",
    "1.23",
    "1.24",
    "1.25",
    "1.26",
    "1.27",
    "1.28",
    "1.29",
    "1.30",
    "1.30.01",
    "1.31",
    "1.31.01",
    "1.31.02",
    "1.31.03",
    "1.32",
    "1.32.01",
    "1.33",
    "1.33.01",
    "1.34",
    "1.35",
    "1.36",
    "1.36.01",
    "1.37",
    "1.38",
    "1.39",
    "1.40",
    "1.41",
    "1.42",
    "1.42.01",
    "1.43",
    "1.44",
    "1.45",
    "1.46",
    "1.47",
    "1.48",
    "1.48.1",
    "1.49",
    "1.50",
    "1.50.1",
    "1.51",
    "1.52",
    "1.53",
    "1.53.1",
    "1.54",
    "1.55",
    "1.56",
    "1.57",
    "1.58",
    "1.58.1",
    "1.59",
    "1.60",
    "1.61",
    "1.62",
    "1.62.1",
    "1.62.2",
    "1.63",
    "1.64",
    "1.64.1",
    "1.65",
    "1.65.1",
    "1.66",
    "1.67",
    "1.68",
    "1.69",
    "1.70.0",
    "1.70.1",
    "21.1.0",
    "21.10.0",
    "21.10.1",
    "21.10.2",
    "21.11.0",
    "21.12.0",
    "21.12.1",
    "21.2.0",
    "21.3.0",
    "21.4.0",
    "21.5.0",
    "21.5.1",
    "21.6.0",
    "21.7.0",
    "21.8.0",
    "21.9.0",
    "21.9.1",
    "22.1.0",
    "22.10.0",
    "22.11.0",
    "22.12.0",
    "22.2.0",
    "22.2.1",
    "22.2.2",
    "22.3.0",
    "22.4.0",
    "22.4.1",
    "22.5.0",
    "22.6.0",
    "22.7.0",
    "22.8.0",
    "22.9.0",
    "23.1.0",
    "23.1.1",
    "23.10.0",
    "23.11.0",
    "23.2.0",
    "23.4.0",
    "23.4.1",
    "23.5.0",
    "23.6.0",
    "23.7.0",
    "23.8.0",
    "23.8.1",
    "23.8.2",
    "23.9.0",
    "23.9.1",
    "24.1.0",
    "24.2.0",
    "24.3.0"
  ]
}

Set up in your agent.

Investigate in your agent.